thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active1,002 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Cole Manufacturing | June 15, 2026 | ransomware_live | — |
| Kozminski University | June 15, 2026 | ransomware_live | — |
| Constructions Piraino | June 15, 2026 | ransomware_live | — |
| Fecovita | June 15, 2026 | ransomware_live | — |
| Traublinger | June 15, 2026 | ransomware_live | — |
| Times Software | June 15, 2026 | ransomware_live | — |
| National Museum | June 15, 2026 | ransomware_live | — |
| Buratti | June 15, 2026 | ransomware_live | — |
| SigmaControl | June 15, 2026 | ransomware_live | — |
| Mackay Sugar | June 15, 2026 | ransomware_live | — |
| Executive Coach | June 15, 2026 | ransomware_live | — |
| Centre Medical Crowley | June 15, 2026 | ransomware_live | — |
| Linnecken Partner | June 15, 2026 | ransomware_live | — |
| Palmer Sicard | June 15, 2026 | ransomware_live | — |
| Ministarstvo zdravstva Republike Hrvatske | June 15, 2026 | ransomware_live | — |
| Calipage Humblet | June 15, 2026 | ransomware_live | — |
| Mahajak Development | June 15, 2026 | ransomware_live | — |
| South Texas Spinal Clinic | June 15, 2026 | ransomware_live | — |
| Enciso Ltda | June 15, 2026 | ransomware_live | — |
| Allensbach Volunteer | June 10, 2026 | ransomware_live | — |
| Tokabei Japan | June 10, 2026 | ransomware_live | — |
| Silmquinas e Equipamentos | June 10, 2026 | ransomware_live | — |
| Scenic Hudson | June 10, 2026 | ransomware_live | — |
| UiTM Holdings | June 10, 2026 | ransomware_live | — |
| WCM Remedium | June 8, 2026 | ransomware_live | — |
| Danzo Group | June 8, 2026 | ransomware_live | — |
| Goldlion | June 8, 2026 | ransomware_live | — |
| Yao Yuan Technology | June 8, 2026 | ransomware_live | — |
| Integrated Distribution | June 8, 2026 | ransomware_live | — |
| The Clinic | June 8, 2026 | ransomware_live | — |
| FESCO Adecco | June 8, 2026 | ransomware_live | — |
| Trigon America | June 8, 2026 | ransomware_live | — |
| Jyharn Electronic | June 8, 2026 | ransomware_live | — |
| Empty | June 8, 2026 | ransomware_live | — |
| Institucion Cervantes | June 8, 2026 | ransomware_live | — |
| Tress | June 8, 2026 | ransomware_live | — |
| Metroply | June 8, 2026 | ransomware_live | — |
| Central Arkansas Pediatrics | June 8, 2026 | ransomware_live | — |
| IP Rings | June 8, 2026 | ransomware_live | — |
| Michigan Surgical Center | June 3, 2026 | ransomware_live | — |
| Thoresen Thai Agencies | June 3, 2026 | ransomware_live | — |
| Edgewood Surgical Hospital | June 3, 2026 | ransomware_live | — |
| Kunal Enterprises | June 3, 2026 | ransomware_live | — |
| 3E Accounting | June 3, 2026 | ransomware_live | — |
| Liztex Guatemala | June 3, 2026 | ransomware_live | — |
| TeLoh | June 3, 2026 | ransomware_live | — |
| Soja de Portugal | June 3, 2026 | ransomware_live | — |
| Downriver Medical Associates | June 3, 2026 | ransomware_live | — |
| Suburban Water | June 1, 2026 | ransomware_live | — |
| Soniva Dental | June 1, 2026 | ransomware_live | — |
| National Industries | June 1, 2026 | ransomware_live | — |
| Bouri Group | June 1, 2026 | ransomware_live | — |
| Computime Group | June 1, 2026 | ransomware_live | — |
| Harrell Martin Peace | June 1, 2026 | ransomware_live | — |
| Brian Jessel BMW | June 1, 2026 | ransomware_live | — |
| Fibrenoire | June 1, 2026 | ransomware_live | — |
| Smile Siam Printing Service | June 1, 2026 | ransomware_live | — |
| Arabian Procession Holding | June 1, 2026 | ransomware_live | — |
| Anandji Haridas | June 1, 2026 | ransomware_live | — |
| M Rocha J Serra Lda | June 1, 2026 | ransomware_live | — |
| Corporacion Prokompra | May 28, 2026 | ransomware_live | — |
| Heartland Growers | May 28, 2026 | ransomware_live | — |
| Fonderia Corra | May 28, 2026 | ransomware_live | — |
| Grupo Premier | May 28, 2026 | ransomware_live | — |
| Techmar | May 26, 2026 | ransomware_live | — |
| Mayelia Automotive | May 26, 2026 | ransomware_live | — |
| Openmind Networks | May 24, 2026 | ransomware_live | — |
| Koa Glass | May 24, 2026 | ransomware_live | — |
| ACAM Systemautomation | May 24, 2026 | ransomware_live | — |
| TRANSSYSTEM Group | May 24, 2026 | ransomware_live | — |
| Caka Grup Lojistik | May 24, 2026 | ransomware_live | — |
| Hussey Seatway | May 24, 2026 | ransomware_live | — |
| Sanatorio Delta | May 24, 2026 | ransomware_live | — |
| Le Perreux sur Marne | May 24, 2026 | ransomware_live | — |
| Seeley Office Systems | May 24, 2026 | ransomware_live | — |
| YMCA of Columbia | May 21, 2026 | ransomware_live | — |
| MBM Corp | May 21, 2026 | ransomware_live | — |
| Grupo Pasquel | May 21, 2026 | ransomware_live | — |
| University of Finance and Administration | May 18, 2026 | ransomware_live | — |
| Modern Display | May 18, 2026 | ransomware_live | — |
| DEVO-Tech | May 18, 2026 | ransomware_live | — |
| E-Control Systems | May 18, 2026 | ransomware_live | — |
| Internet Technologies Designs | May 18, 2026 | ransomware_live | — |
| Polyrack | May 18, 2026 | ransomware_live | — |
| Internal Medicine | May 18, 2026 | ransomware_live | — |
| Ross Yerger Insurance | May 15, 2026 | ransomware_live | — |
| Digiprint | May 14, 2026 | ransomware_live | — |
| Ponisch Abogados | May 14, 2026 | ransomware_live | — |
| Grupo Alvorada | May 14, 2026 | ransomware_live | — |
| Instituut voor de Nederlandse | May 14, 2026 | ransomware_live | — |
| GeTeCe | May 12, 2026 | ransomware_live | — |
| Amstel Securities | May 12, 2026 | ransomware_live | — |
| Dodson & Horrell | May 12, 2026 | ransomware_live | — |
| Value Exchange International | May 12, 2026 | ransomware_live | — |
| SETCAR | May 12, 2026 | ransomware_live | — |
| Oriental Diamond | May 12, 2026 | ransomware_live | — |
| Electroban SAE | May 12, 2026 | ransomware_live | — |
| Qatar National Broadband | May 12, 2026 | ransomware_live | — |
| Shajarpak Securities | May 12, 2026 | ransomware_live | — |
| Focus Design Partners | May 12, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).